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CONQUEST  Quarterly  Progress  Report  #2  for  the  Period 
2  December  2016  - 1  March  2017  (3  Months) 


Section  A.  Task  Progress 

A  program  review  meeting  was  held  at  ONR’s  meeting  site  in  Arlington,  VA  on  February  16th 
and  17th  with  all  team  members  in  attendance.  See  attached  slides  from  review  meeting  showing 
team  progress  against  tasks. 

Section  B.  Planned  Activities/Schedule 

Monthly  team  meetings  have  been  scheduled  and  the  last  monthly  meeting  was  held  at  MIT  on 
February  13th.  The  next  scheduled  team  meeting  will  be  held  via  teleconference  on  March  9th. 
BBN’s  internal  team  meetings  are  scheduled  for  every  other  Tuesday  morning.  For  information 
regarding  planned  technical  activities,  see  the  updates  provided  in  the  attached  slides. 

Section  C.  Equipment  Purchased 

No  equipment  has  been  purchased  or  constructed  at  this  time. 


Section  D.  Key  Personnel 

There  have  been  no  changes  in  personnel. 


Section  E.  Accomplishments 

See  updates  provided  in  Sections  A  and  B  above.  In  addition,  please  find  attached  a  memo  from 
Jeff  Shapiro  in  response  to  the  SPAWAR-provided  atmospheric  data. 

Section  F.  Anticipated  Problems 

There  are  no  anticipated  problems  or  issues  to  report  at  this  time. 


2  |  Page 


Approved  for  public  release;  distribution  is  unlimited.  This  document  ©2017  Raytheon  BBN  Technologies 

does  not  contain  technology  or  technical  data  controlled  under  either  the  U.S. 

International  Traffic  in  Arms  Regulations  or  the  U.S.  Export  Administration  Regulations. 


Section  G.  CONQUEST  Budget 
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Questions  Regarding  “Quantum  Key  Distribution:  Atmospheric  Profiles 

of  Extinction  and  Turbulence” 

Jeffrey  H.  Shapiro 

Research  Laboratory  of  Electronics,  Massachusetts  Institute  of  Technology,  Cambridge,  Massachusetts  02139 

(Dated:  February  2,  2017) 

Dr.  Tommy  Willis  (Office  of  Naval  Research)  has  asked  his  Maritime  QKD  teams  to  employ  the 
SPAWAR-provided  atmospheric  extinction  and  turbulence  data  from  [1]  to  assess  the  operational 
utility  of  their  respective  quantum  key  distribution  (QKD)  protocols.  The  present  memo  raises  a 
series  of  questions  about  that  data  that  are  relevant  to  the  Raytheon-BBN  led  CONQUEST  team’s 
attempt  to  follow  through  on  Dr.  Willis’  request. 


Introduction 

Drs.  McBryde  and  Hammel  have  prepared  a  compilation  of  atmospheric  extinction  and  turbulence  data  for  a 
30-km-long  maritime  path  [1].  In  particular,  they  have  used  atmospheric  models  for  absorption,  scattering,  and 
refractive-index  turbulence  as  functions  of  the  principal  meteorological  parameters  to  generate  vertical  profiles  (from 
h  =  1  to  h  =  50  m  above  the  sea  surface)  of  the  molecular  and  aerosol  absorption  coefficients,  the  molecular  and 
aerosol  scattering  coefficients,  and  the  turbulence  strength  (C^(h))  at  780 nm,  1550 nm,  and  4000 nm  wavelengths. 
Then,  using  a  huge  database  of  meteorological  data  from  the  Point  Mugu  Sea  Range  (PMSR),  they  generated  icosile 
histograms  of  extinction-only  and  turbulence-only  normalized  power-in-bucket  (PIB)  values  when  transmission  is 
between  equal-height-above-sea-surface  terminals  that  use  26.5-cm-diameter  pupils  at  19  m,  30  m,  or  50  m  above  the 
sea  surface.  Also  distributed  with  Ref.  [1]  were  Excel  spreadsheets  that  provide  10%,  50%,  and  90%  decile  PIB 
results  for  extinction-only  and  turbulence-only  conditions  at  the  three  wavelengths,  along  with  sample  height  profiles 
from  each  of  those  deciles  of  the  molecular  and  aerosol  absorption  coefficients,  the  molecular  and  aerosol  scattering 
coefficients,  and  C^(h),  plus  (for  the  turbulence  case)  the  Fried  parameter  ro  for  each  of  these  PIB  deciles.  In  the 
CONQUEST  team’s  attempt  to  make  use  of  this  trove  of  information  a  number  of  questions  have  arisen.  The  purpose 
of  this  memo  goes  beyond  merely  asking  those  questions.  Indeed,  it  explains  how  they  have  arisen  in  trying  to  use 
the  data  provided  in  [1]. 


Transceiver  Question 


In  [2]  we  learned  that  Ref.  [1]  assumes  a  transmitter  exit  pupil  and  a  receiver  entrance  pupil  that  are  26.5-cm- 
diameter  unobscured  circular  apertures.  For  our  performance  analyses,  we  plan  to  assume  the  transmitter  employs  a 

uniform- intensity,  focused-beam,  spatial  mode.  In  particular,  if  Eo(p)  and  El(p' )  are  the  ^W/m2  complex  field  en¬ 
velopes  at  p  =  (x,  y)  in  the  transmitter’s  exit  pupil  and  p'  =  (x',  y')  in  the  receiver’s  entrance  pupil  for  monochromatic 
(wavelength  A)  transmission  through  a  fixed  atmospheric  state  then 


Eo(p)  =  { 


■ik\p\2/2L,  for  |p|  <  ^2, 


1° 


otherwise, 


(i) 


where  Pt  is  the  transmitted  power,  d  =  26.5  cm  is  the  transmitter  pupil’s  diameter,  L  =  30  km  is  the  path  length, 
and  k  =  2tt/X  is  the  wave  number  at  the  operating  wavelength; 


PIBext  = 


2-/  dp' \EL(p')ext\2  =  2-  f  d p  I  dpEo(p) 

r T  J\p'\<d/2  U  J\p'\<d/2  J\p\<d/2 
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(2) 


is  the  extinction-only  PIB  with 


d z  a[hp(z)\ 


(3) 


giving  the  path-averaged  extinction  coefficient  along  the  path  from  the  transmitter  (z  =  0)  to  the  receiver  (z  =  L) 
in  terms  of  the  extinction  coefficient’s  height  distribution  a(h)  and  the  propagation  path’s  height-above-sea-surface 
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hp(z )  [3];  and 


PIBturb  = 

-t  T 
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(4) 

being  the  turbulence-only  PIB,  where  (•)  denotes  averaging  over  the  turbulence,  and  %(p',p)  and  0(p',p)  are  the 
log-amplitude  and  phase  fluctuations  seen  at  p'  in  the  receiver  pupil  that  turbulence  imposes  on  a  point  source 
transmission  from  p  in  the  transmitter  pupil. 

It  should  be  clear  from  the  preceding  development  that  both  PIB’s  will  depend  on  the  choice  made  for  the  trans¬ 
mitter’s  spatial  mode.  Reference  [1]  is  silent  about  its  choice  of  spatial  mode.  In  [2]  we  learned  that  Ref.  [1]  assumed 
a  Gaussian  beam, 


e-\p\2/r2-ik\p\2/2R 


u 


,  for  \p\  <  d/2, 


otherwise, 


(5) 


but  we  were  not  given  values  for  r  and  R,  although  it  was  tentatively  stated  that  r  =  d/2  and  R  =  L.  Our  transceiver 
question  is  therefore  as  follows. 

Transceiver  Question:  What  is  e~2 -attenuation  intensity  radius ,  r,  and  the  phase  curvature ,  R ,  for  the 
Gaussian-beam  spatial  mode  used  in  Ref .  [1]? 


Decile  Questions 

In  studying  Ref.  [1]  and  its  accompanying  spreadsheets,  we  noted  that  the  memo’s  icosiles  rank  the  extinction-only 
and  turbulence-only  PIBs  from  low  to  high,  i.e.,  the  10%  icosile’s  PIB  is  less  than  the  50%  icosile’s  PIB  that,  in  turn, 
is  less  than  the  90%  icosile’s  PIB.  The  opposite,  however,  is  true  for  the  deciles,  viz,  the  spreadsheets’  extinction-only 
and  turbulence-only  10%  decile  PIBs  exceed  their  50%  counterparts  that,  in  turn,  exceed  the  90%  decile  PIBs.  Going 
forward,  we  will  employ  the  deciles  information,  because  numerical  values  are  provided.  In  order  to  make  best  use  of 
that  information,  however,  the  team  would  like  answers  to  the  following  questions 

Decile  Question  1:  Do  the  10%,  50%,  and  90%  decile  PIBs  in  the  spreadsheets  represent  averages  of 
the  PIB  values  in  those  deciles? 

Decile  Question  2:  Presuming  the  answer  to  Decile  Question  1  is  yes,  what  are  the  minimum  values, 
maximum  values,  and  standard  deviations  of  the  PIBs  in  the  10%,  50%,  and  90%  deciles? 

(The  importance  of  Decile  Question  2 — which  seeks  to  understand  how  much  PIB  variability  there  is  within  the  10%, 
50%,  and  90%  deciles — will  become  apparent  in  the  next  section.) 


PIB,  a,  and  ro  Questions 


Our  uniform-intensity,  focused-beam,  spatial  mode  leads  to  the  following  results  for  PIBext  and  PIBturb  [4].  For 
the  extinction-only  case  we  have 


PIBext  =  {-VD~f  dCJi(4/D7C)  cos-^O-Ca/I-C2 


-olL 


where 


Df  = 


(~)2 

\4A  L  ) 


(6) 


(7) 


is  the  vacuum-propagation  Fresnel-number  product,  Ji(-)  is  the  first-order  Bessel  function  of  the  first  kind,  and  the 
term  in  braces  is  the  PIB  for  vacuum  propagation,  which  we  will  denote  PIBvac.  For  the  turbulence-only  case  we  find 


PIBturb  =  -y/D}  /  dCJ^y/Dj  C)  COS-1(C)  -  <^1  -  C2 
n  Jo  L 


D-(3.18Cd/r0)5/3/2 


(8) 
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where  we  have  assumed  Kolmogorov-spectrum  turbulence  with  zero  inner  scale  and  infinite  outer  scale,  and 


r0  =  3.18 


2.91  k2  /  dz  Cn[hp(z)](z / L )5^3 

Jo 


-3/5 


(9) 


with  C^[hp(z)\  being  the  turbulence-strength  parameter  along  the  path  from  the  transmitter  (z  =  0)  to  the  receiver 
(z  =  L )  is  the  spherical- wave  Fried  parameter  [5] . 

At  this  point,  some  general  PIB  statements  deserve  presentation.  First,  PIBvac  obeys  the  following  inequality, 

PIBVac  <  min(l,  Df),  (10) 

regardless  of  the  transmitter’s  spatial  mode.  Moreover,  for  the  uniform- intensity,  focused-beam  spatial  mode  we  have 
that 


PIBV 


r- 

U>f, 


for  Df  >  1, 
for  Df  <  1, 


(11) 


whose  cases  represent  the  near- field  (Df  1)  and  far- field  (Df  <C  1)  power-transfer  regimes,  respectively.  Second, 
PIBturb  has  the  following  behavior  for  the  uniform-intensity,  focused-beam  spatial  mode  when  Df  <C  1, 


PIBturb 


Df ,  for  r0  >  d, 


for  r0  <C  d, 


(12) 


whose  cases  represent  the  diffraction-limited  (r*o  d)  and  turbulence-limited  (ro  <C  d)  far-held  power-transfer  regimes, 
respectively. 

Because  Ref.  [1]  assumes  a  Gaussian-beam  spatial  mode  for  its  transmitter’s  beam  pattern,  we  have  taken  an 
untruncated  Gaussian  beam,  namely 


Eo(p)  =  \l  —p  e 


8Pt  —A\p\2/d2—ik\p\‘2/2L 


(13) 


as  a  simple  proxy  for  obtaining  general  performance  results  analogous  to  those  in  Eqs.  (10)-(12)  that  should  be 
qualitatively  indicative  of  how  Eq.  (5)  with  r  =  d/2  and  R  =  L  would  perform.  For  this  transmitter  beam  pattern — 
and  Df  still  given  by  Eq.  (7) — PIBvac  satisfies 


pOO 

PIBvac  =  4 ^D~f  J I  dC  C), 


Jo 

which  has  near-held  and  far-held  power-transfer  regimes  obeying 

f  1,  for  Df  »  1, 

PIBvac  1 

\  2 Df,  for  Df  <  1, 

For  this  transmitter  beam  pattern — and  Df  still  given  by  Eq.  (7) — PIBtUrb  satisfies 

poo  _ 

PIBturb  =  4  J  dCe-2^J1(4V/^7C)e“(3-18Cd/ro)  /2, 

which  has  dihraction-limited  and  turbulence-limited  far-held  (Df  <C  1)  power-transfer  regimes  obeying 


(14) 


(15) 


(16) 


PIBturb 


{ 


PIB 

Df, 


vac  5 


for  r0  >  d, 
for  r0  <C  d, 


(17) 


With  the  preceding  results  in  hand,  we  now  state  some  questions. 

PIB  Question  1  At  each  wavelength  the  sample  height  profiles  given  for  the  molecular  absorption  and 
scattering  coefficients ,  the  aerosol  absorption  and  scattering  coefficients ,  and  the  extinction  co¬ 
efficient  are  the  same  for  all  three  deciles  and  for  all  three  terminal  heights .  Why  is  it  that  the 
PJBext  values  at  each  wavelength  for  those  deciles  and  terminal  heights  can  differ  by  more  than 
an  order  of  magnitude?  They  should  all  be  the  same ,  unless  there  is  a  large  amount  of  P/Bext 
variability  within  each  decile . 
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PIB  Question  2:  At  some  wavelengths  the  C^(h)  profiles  are  the  same  for  the  same  decile  and  different 
terminal  heights .  Why  is  it  that  the  PIBtur b  values  for  those  cases  differ  appreciably?  They 
should  be  the  same ,  unless  there  is  appreciable  PIBtur b  variability  within  those  deciles . 

a  Question:  For  each  decile  at  each  wavelength/height  choice ,  how  much  variability  is  there  in  the 
path- averaged  extinction  coefficient? 


ro  Question  1:  Are  the  reported  ro  values  those  for  the  spherical-wave  Fried  parameter ,  or  those  for  the 


plane-wave  Fried  parameter ,  ro  =  3.18 


2Mk1 2J0LdzCZ[hp(z)} 


-3/5 


?  Note  that  the  plane-wave  Fried 


parameter  is  always  greater  than  its  spherical-wave  counterpart . 


As  the  preceding  questions  clearly  suggest,  there  must  be  significant — in  some  cases  dramatic — variations  of  ex¬ 
tinction  and  Cn(h)  profiles  within  each  of  the  spreadsheets’  deciles.  Further  evidence  for  the  variability  within  each 
wavelength’s  turbulence-only  90%  decile  comes  from  evaluating  PIBturb  for  the  90%  decile  ro  values  given  in  the 
spreadsheets  under  the  assumption  that  the  spreadsheet  is  reporting  the  spherical-wave  ro  and  using  the  PIBturb 
formulas  from  Eqs.  (8)  or  (16).  Such  evaluations  all  give  PIBturb  values  much  higher  than  the  spreadsheet’s  PIBtUrb 
values.  Note  that  PIBturb  is  a  monotonically  increasing  function  of  ro-  So,  if  the  spreadsheet’s  ro  values  are  plane- wave 
results,  then  the  evidence  for  high  variability  in  the  90%  decile  results  is  even  stronger.  Of  course,  Ref.  [l]’s  use  of  a 
truncated  Gaussian  spatial  mode  at  the  transmitter  will  likely  reduce  the  PIBturb  values  from  those  obtained  under 
the  assumption  of  a  uniform-intensity  focused  beam,  but  if  r  =  d/2  and  R  =  L,  as  [2]  suggested,  it  is  still  true  that 
the  spreadsheets’  ro  values  will  not  predict  their  90%  decile  PIBturb  values. 

An  altogether  different  problem  shows  up  in  the  10%  PIBturb  values  given  in  the  spreadsheets  for  4000  nm  wavelength 
at  19  m  and  50  m  heights.  The  vacuum-propagation  Fresnel- number  product  for  4000  nm  wavelength,  30  km  path 
length,  and  26.5  cm  diameter  unobscured  circular  apertures  is  Df  =  0.211.  Yet  the  10%  decile  PIBtUrb  values  reported 
for  19  m  and  50  m  heights  are  0.379  and  0.372,  respectively,  clearly  violating  the  PIBturb  <  min(l ,Df)  upper  bound. 
This  leads  to  our  final  PIB  question. 

PIB  Question  3:  How  can  the  10%  decile  PIBtur b  values  for  4000  nm  wavelength ,  30  km  path  length , 
and  26.5  cm  diameter  unobscured  circular  apertures  exceed  the  min(l,Z)/)  upper  bound? 


PIBs  for  Extinction  and  Turbulence 

QKD  systems  in  the  maritime  environment  will  suffer  transmission  losses  from  both  extinction  and  turbulence. 
One  might  argue  that  the  worst  scattering — say  from  a  dense  fog — occurs  in  stable  air,  thus  reducing  its  atmospheric 
turbulence.  Hence  combining  the  worst-case  (90%  decile)  extinction  transmissivity  with  the  worst-case  turbulence 
transmissivity  to  get  an  overall  transmissivity  is  probably  unduly  conservative.  Likewise  combining  the  best-case 
(10%  decile)  extinction  transmissivity  with  the  best  case  turbulence  loss  to  get  an  overall  transmissivity  is  probably 
unduly  optimistic.  Both  situations  are  almost  certainly  exacerbated  by  the  evidence  for  significant  PIBext  and  PIBturb 
variability  within  all  the  deciles.  This  consideration  leads  to  our  final  questions. 

Extinction  and  Turbulence  Question  1:  Can  you  provide  information  about  the  correlation  (or  anti¬ 
correlation)  between  extinction- only  transmissivity  and  turbulence- only  transmissivity ,  e.g .,  can 
you  provide  (at  each  wavelength)  10%,  50%,  and  90%  decile  PIBs  for  extinction  plus  turbulence? 


[1]  K.  McBryde  and  S.  Hammel,  “Quantum  key  distribution:  Atmospheric  profiles  of  extinction  and  turbulence,”  SPAWAR 
Systems  Center,  Pacific. 

[2]  26  January  2017  telephone  conversation  between  Dr.  Kevin  McBryde  (SPAWAR),  Dr.  Boulat  Bash  (Raytheon  BBN),  and 
Prof.  Jeffrey  Shapiro  (MIT). 

[3]  The  height-above-sea-surface,  hp(z ),  is  given  by  hp(z)  —  yf[Re  +  hp(L/ 2)]2  +  [z  —  L/ 2)2  —  Re,  where  Re  —  6.378  x  106  m  is 
the  Earth’s  radius,  and  hp[L/ 2),  the  propagation  path’s  minimum  height- above-sea- surface,  can  be  found  from  hp{L/ 2)  = 
yf  (Re  +  h)2  —  ( L/2 )2  —  Re,  with  h  being  the  terminals’  height- above-sea- surface. 

[4]  J.  H.  Shapiro,  “Normal-mode  approach  to  wave  propagation  in  the  turbulent  atmosphere,”  Appl.  Opt.  13,  2614-2619  (1974). 

[5]  In  our  calculations  we  use  ro  —  3.18  |^2.91/c2  f^2  dz  Cn[hp(z  —  L/2)]  ({z/L  +  1  / 2)5^3  +  (1/2  —  z/L)5/3^J  for  the 

spherical-wave  case,  and  ro  =  3.18  1^5.82/c2  f^2  d zCn[hp(z  —  L/2)]l  for  the  plane-wave  case. 
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•  BBN 

-  Saikat  Guha  (PI),  Boulat  Bash,  Hari  Krovi,  Prithwish  Basu, 
Zachary  Dutton,  Jonathan  Habit:  QIT,  quantum  security,  secure 
and  covert  communications,  quantum  repeaters,  network  design 
and  routing 

-  Kathryn  Carson:  Program  manager 

•  LSU 

-  Mark  Wilde:  QIT,  finite-length  security  analysis 

•  MIT 

-  Jeff  Shapiro,  Franco  Wong,  Dirk  Englund,  Zheshen  Zhang 
[students:  Darius  Bunandar,  Mihir  Pant]:  Quantum  optics,  FL 
QKD,  PIC  for  QKD  transceivers,  theory  of  non-classical  sources 
and  atmospheric  propagation  modeling 

•  U.  Toronto  /  CipherQ 

-  Christian  Weedbrook,  Kamil  Bradler:  CV  QKD  theory  and 
hardware,  FPGA,  classical  post-processing  for  CV  QKD,  CV-MDI 
QKD,  repeater  analysis 
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•  Contract  Name: 

Communications  and  Networking  with  Quantum 
operationally-secure  technology  for  maritime 
deployment  (CONQUEST) 

•  Prime  Contract  Number: 

N0001 4-1 6-C-2069 

•  BBN  Ref  ID: 

14660 

•  Customer: 

US  Navy/ONR 

•  Period  of  Performance: 

9/2/2016-9/1/2019 
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Deliverable 

Due  Date 

1 

Quarterly  Progress  Reports 
(technical  and  financial) 

12/1;  3/1;  6/1;  9/1 

2 

Program  Review  Presentation  Material 

As  required 

3 

YR  3  Contractor  Manpower  Report 
(all  labor  hours) 

Annually;  by  10/31 

4 

Annual  Report 

9/1/17;  9/1/18;  9/1/19 

5 

List  of  Property  Acquired  or  Provided 

Annually;  by  6/30 

6 

Final  Report/Design  Recommendation  Manual 

By  10/2/2019 
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Saikat  Guha 
Principal  Investigator 
BBN  Technologies 
saikat.auha@ravtheon.com 

617-873-5122 


Kathryn  Carson 
Program  Manager 
BBN  Technologies 
kathryn.carson@ravtheon.com 

617-873-8144 


Invoices: 

http://connect.transcepta.com/ravtheon 
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•  Quantum-secured  free-space  optical 
communications  and  networking 


©Trusted  nodes 

QUn-trusted  quantum  (repeater  or  MDI)  nodes 
OUn-trusted  quantum  (processor)  nodes 


kn 


Goal:  advancing  the  theory 
and  practice  of  FS  QKD 
over  maritime  channel 
conditions  with  an 
objective  of  maximizing 
throughput ,  and 
minimizing  classical 
communications  and 
processing  overhead.  We 
focus  on  protocol 
development  (CV  and  CV- 
like,  discrete  constellation), 
security  analyses,  finite- 
size,  efficient  post¬ 
processing,  compact 
integrated-photonic 
transceiver  design,  FPGA 
based  post-processing, 
networking. 


(overlaid  is  a  classical  in-secure  authenticated  RF  network:  MANET-4G  hybrid) 


Program  structure 


Task  1 :  QKD  operation  and 
security  analysis  for  a  naval 
atmospheric  link  with  a 
realistic  eavesdropper 

Task  2:  Maritime- 
implementable  QKD 
protocols 

Task  3:  Maximizing  the 
information  efficiency  of  QKD 


Task  4:  Improved  hardware- 
domain  signal  processing  \ 

Task  5:  QKD  network  via  un¬ 
trusted  quantum  nodes  \ 

Task  6:  Important  technical  / 
issues  to  address  current  / 
deficiencies  in  the 
theory/practice  of  QKD 
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Saikat  /  Kathryn  -  team  introduction,  task 
descriptions  and  technical  plan:  10  minutes 

Jeff  -  Security  analysis  with  realistic 
eavesdropping  assumptions:  15  minutes 

Jeff  /  Franco  -  Flood  light  QKD:  theory  and 
experiments:  15  minutes 

Kamil  -  security  proof  for  discrete  modulation 
CV  QKD:  15  minutes 

Saikat  -  efficient  post-processing  for  CV  QKD: 

15  minutes 

Mark  -  Finite  key-length  analysis  for  QKD:  15 

minutes 

Darius  /  Dirk  -  PIC  based  transmitters  and 
receivers  for  QKD:  15  minutes 

Saikat  -  Free-space  quantum  networking  / 
wrap  up  - 15  minutes 
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Year  1 

Year  2 

Year  3 

i  1.1.1 

Realistic  wiretap 

119 

>'  1 

Hardware  and  so 

- hrhc — r 

ftware  restrictions 

Rate  calc,  attacks 

5 

2  11 

2  12 

Develop  discrete 

mod  CV  protocql 

Error  .correction 

1 

1  2  11 

Security  proof  for 

discrete-modulati 

)n  CV  protocol 

Multiplexing:  spa 

3  11 

ial,  frequency' ' 

Discrete-modulat 

on  QKD  protocc  1 

n  high-BW  SPDC 

5.1 

1 

3  12 

Security  proof  fo 

SPDC  protocol 

^Custorr 

- — - J\ 

- 4^1- 

l  FPGA 

M  Q 

Classical  proc.  re 

juireme 

4.2! 

it/tradeoff 

1 

zn 

MDI-CV  network 

Kjoint  Pi 

M-E^C 

r  O 

Physical  optics  at 

nodes 

A 

;  vis-a-vis  re 

te-loss  scalings 

y  Mult 

i-flow  routin' 

)  for  QKD 

Finite  key-length 

security  analysis 

6  2 

Limits  and  protocc 

)ls  for  quantum-se 

cure  LPD  and~A7l 
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•  M.  Takeoka,  M.  Wilde,  “Optimal  estimation  and  discrimination  of  excess 
noise  in  thermal  and  amplifier  channels”,  arXiv:1 611 .09165  (2016). 

•  B.  A.  Bash,  N.  Chandrasekaran,  J.  H.  Shapiro,  S.  Guha,  “Quantum  Key 
Distribution  Using  Multiple  Gaussian  Focused  Beams,” 

arXiv:1 604.08582  [quant-ph]  (2017). 

•  M.  Pant,  S.  Muralidharan,  D.  Englund,  L.  Jiang,  and  S.  Guha, 
“Resource-cost  vs.  rate-distance  tradeoffs  for  all-photonic 
implementation  of  one-way  quantum  repeater  architecture”,  in 
preparation  (2017). 

•  S.  Guha,  M.  Takeoka,  N.  Lutkenhaus,  “CV  QKD  with  block  post¬ 
processing”,  in  preparation  (2017). 

•  M.  Takeoka,  S.  Guha,  H.  Krovi,  N.  Lutkenhaus,  “Discrete  modulation  CV 
QKD  with  finite-bin  post-processing”,  in  preparation  (2017) 

•  M.  Pant,  L.  Jiang,  D.  Towsley,  P.  Basu,  H.  Krovi,  D.  Englund,  S.  Guha, 
“Multipath  routing  in  a  quantum  repeater  network”,  in  preparation  (2017). 

•  J.  H.  Shapiro,  “Questions  Regarding  Quantum  Key  Distribution:  9 
Atmospheric  Profiles  of  Extinction  and  Turbulence,  Feb  2,  (2017). 


Awards 

•  Prof.  Dirk  Englund 

-  201 7  Adolph  Lomb  Medal 

-  Citation:  for  pioneering  contributions  to  scalable  solid-state  quantum 
memories  in  nitrogen-vacancy  diamond,  high-dimensional  quantum 
key  distribution,  and  photonic  integrated  circuits  for  quantum 
communication  and  computation. 

•  Dr.  Boulat  Bash  and  team 

-  2016  NSA  Annual  Best  Scientific  Cybersecurity  Paper 

-  2016  Raytheon  Excellence  in  Engineering  and  Technology 
(EiET)  Award 

Quantum-Secure  Covert  Communication  on  Bosonic  Channels,  Boulat 
Bash,  Andrei  H.  Gheorghe,  Monika  Patel,  Jonathan  L.  Habif,  Dennis  Goeckel, 
Don  Towsley,  and  Saikat  Guha,  Nature  Communications  6,  8626  (2015) 

-  Citation  [NSA]:  This  research  adds  critical  information  to  the 

exploration  of  covert  communications,  the  transmission  of 
information  without  detection  by  watchful  adversaries.  10 
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Saikat  /  Kathryn  -  team  introduction,  task  descriptions,  plan:  10  minutes 
Jeff  -  Security  analysis  w/  realistic  eavesdropping  assumptions:  15  minutes 
Jeff  /  Franco  -  Flood  light  QKD:  theory  and  experiments:  15  minutes 
Kamil  -  security  proof  for  discrete  modulation  CV  QKD:  15  minutes 
Saikat  -  efficient  post-processing  for  CV  QKD:  15  minutes 
Mark  -  Finite  key-length  analysis  for  QKD:  15  minutes 
Darius  /  Dirk  -  PIC  based  transmitters  and  receivers  for  QKD:  15  minutes 
Saikat  -  Free-space  quantum  networking  /  wrap  up  - 15  minutes 
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Saikat  /  Kathryn  -  team  introduction,  task  descriptions,  plan:  10  minutes 

Jeff  -  Security  analysis  w/  realistic  eavesdropping  assumptions:  15  minutes 

Jeff  /  Franco  -  Flood  light  QKD:  theory  and  experiments:  15  minutes 

Kamil  -  security  proof  for  discrete  modulation  CV  QKD:  15  minutes 

Saikat  -  efficient  post-processing  for  CV  QKD:  15  minutes 

Mark  -  Finite  key-length  analysis  for  QKD:  15  minutes 

Darius  /  Dirk  -  PIC  based  transmitters  and  receivers  for  QKD:  15  minutes 

Saikat  -  Free-space  quantum  networking  /  wrap  up  - 15  minutes 
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Communications  and  Networking  with  Quantum  Operationally- 
Secure  Technology  for  Maritime  Deployment  (CONQUEST) 


Eavesdropper  Assumptions  and  Security 
Requirements:  Implications  for  Secret-Key  Rates 


Jeffrey  H.  Shapiro 

Massachusetts  Institute  of  Technology 

Maritime  QKD  Review  Meeting 
February  17,  2017 
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Eavesdropper  Assumptions  ESSS-dS  LSH  ,3. 
and  Security  Requirements 

•  Attacks  on  fiber-channel  QKD  systems 

-  undetectable  passive  eavesdropper 

-  coherent,  collective,  and  individual  attacks 

-  photon-number  splitting  attack 

-  side-channel  attacks:  blinding  and  time-shift... 

•  Attacks  on  free-space  QKD  systems 

-  passive  eavesdropper 

-  coherent,  collective,  and  individual  attacks 

-  realistic  attacks  on  QKD  protocol 

-  side-channel  attacks  on  QKD  equipment 
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Fiber-Channel  QKD:  BBNTechnologiesj^i,  |"*M  cS, 

Undetectable  Passive  Eavesdropper 


•  Alice  and  Bob  linked  by  low-loss  optical  fiber 

-  long  distance,  high  loss,  no  eavesdropper 


•  Attack  by  undetectable  passive  eavesdropper 

-  long  distance,  high  loss  create  vulnerability 

-  BB84  &  CV-QKD  security  requires  low  photons/symbol 


•  Long-distance,  fiber-channel  QKD  has  low  secret-key  rate 
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Fiber-Channel  QKD:  BBNTechnologiesj^i,  1™*!^! 

Coherent,  Collective  and  Individual  Attacks 


•  Coherent  attack 
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•  Photon-number  splitting  attack 


Free-Space  QKD: 


Atmospheric  Propagation  Effects 

•  Propagation  geometry 


receiver  pupil  p'  G  Ar 


Alice 


L-m-long  path 


transmitter  pupil  p  G  At 


•  Propagation  effects 

-  absorption 

-  depolarization 

-  beam  spread  and  angle-of-arrival  spread 

-  multipath  spread  and  Doppler  spread 

-  time-dependent  fading  (scintillation) 
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Free-Space  QKD: 


Attacking  the  Direct-Path  Line  of  Sight 

•  Eve  flies  electromagnetically-cloaked  drone  in  direct- 
path  line  of  sight 


Alice 


transmitter  pupil  _  At 


-  coherent  attack:  drone  does  full-session  quantum  interaction, 
monitors  classical  channel,  and  does  post-monitoring  collective 
measurement 

-  backing  off  to  collective  attack  does  not  greatly  increase 
feasibility;  even  individual  attack  strains  credulity 
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Free-Space  QKD:  BBNtohnologiesj^i  c»Sf 

Attacking  from  Outside  the  Direct  Path 


•  Eve  flies  one  or  more  terminals  for  reception  and/or 
transmission 


-  Alice  and  Bob’s  line-of-sight  observations  limit  Eve’s  reception 
capability  —  to  be  determined  in  Task  1 


-  Alice  and  Bob’s  field-of-view  control  limits  Eve’s  transmission 
capability  —  to  be  determined  in  Task  1 
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Free-Space  QKD:  BBNtohnologiesj^i  c»Sf 

Attacking  from  Outside  the  Direct  Path _ 

•  Eve  flies  one  or  more  terminals  for  reception  and/or 
transmission 


•  Task  1  constraints  on  Eve’s  equipment 

-  collective  attack  with  finite  coherence-time  quantum  memory 

-  individual  attack  with  quantum-limited  conventional  receiver 

•  Task  1  options  to  reduce  Eve’s  capability 

-  exploit  atmospheric  reciprocity  with  variable-rate  transmission 

-  exploit  atmospheric  reciprocity  with  bidirectional  adaptive  optics 
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•  CONQUEST  team  will  assume  that  Eve... 

-  attacks  from  outside  the  line  of  sight 

-  could  have  a  finite  coherence-time  quantum  memory 

-  has  ideal  lasers,  squeezers,  filters,  beam  splitters, 
and  single-photon  detectors 

•  CONQUEST  team  will  evaluate... 

-  Eve’s  ability  to  collect  light  from  the  quantum  channel 

-  Eve’s  ability  to  transmit  light  into  Alice  and/or  Bob 

-  Alice  and  Bob’s  secret-key  rates  for  principal  QKD 
protocols  of  interest,  e.g.,  BB84,  CVQKD,  FL-QKD,..., 
when  operating  against  Eve’s  constrained  attacks 
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Preliminary  Results:  Sg=Ud£ lsu .q 

Decoy-State  BB84  Secret-Key  Rates 


•  Lower  bounds  on  ergodic  secret-key  rates  (SKRs) 


780  nm  wavelength 

1550  nm  wavelength 

4000  nm  wavelength 

height 

decile 

ds-BB84  SKR 

Pirandola  bound 

ds-BB84  SKR 

Pirandola  bound 

ds-BB84  SKR 

Pirandola  bound 

19  m 

10% 

25.33  Mbps 

106.79  Mbps 

35.54  Mbps 

150.95  Mbps 

7.69  Mbps 

33.29  Mbps 

19  m 

50% 

0.833  Mbps 

5.17  Mbps 

1.69  Mbps 

8.80  Mbps 

0.710  Mbps 

4.64  Mbps 

19  m 

90% 

0 

35.62  kbps 

0 

75.21  kbps 

0 

0.117Mbps 

30  m 

10% 

95.96  Mbps 

443.66  Mbps 

108.18  Mbps 

510.76  Mbps 

13.48  Mbps 

57.07  Mbps 

30  m 

50% 

9.06  Mbps 

38.93  Mbps 

14.44  Mbps 

61.05  Mbps 

2.89  Mbps 

21.88  Mbps 

30  m 

90% 

0 

0.492  Mbps 

0 

1.02  Mbps 

13.20  kbps 

1.45  Mbps 

50  m 

10% 

159.33  Mbps 

831.45  Mbps 

162.29  Mbps 

852.43  Mbps 

15.93  Mbps 

67.22  Mbps 

50  m 

50% 

27.65  Mbps 

116.70  Mbps 

38.33  Mbps 

163.23  Mbps 

8.76  Mbps 

37.70  Mbps 

50  m 

90% 

31.42  kbps 

1.54  Mbps 

0.336  Mbps 

3.14  Mbps 

0.560  Mbps 

4.00  Mbps 

-  average  transmissivities:  McBryde  &  Hammel  extinction  + 
turbulence  profiles  and  a  constant-intensity  focused  beam 

-  DS-BB84  SKR  lower  bound:  Chandrasekaran  Ph.D.  thesis 
(MIT  EECS,  2016)  with  1  Gbps  source,  unity  quantum 
efficiencies,  and  10'4  background  +  dark  counts  per  bit 
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Jeff  -  Security  analysis  w/  realistic  eavesdropping  assumptions:  15  minutes 
Jeff  /  Franco  -  Flood  light  QKD:  theory  and  experiments:  15  minutes 
Kamil  -  security  proof  for  discrete  modulation  CV  QKD:  15  minutes 
Saikat  -  efficient  post-processing  for  CV  QKD:  15  minutes 
Mark  -  Finite  key-length  analysis  for  QKD:  15  minutes 
Darius  /  Dirk  -  PIC  based  transmitters  and  receivers  for  QKD:  15  minutes 
Saikat  -  Free-space  quantum  networking  /  wrap  up  - 15  minutes 
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Communications  and  Networking  with  Quantum  Operationally- 
Secure  Technology  for  Maritime  Deployment  (CONQUEST) 


Floodlight  Quantum  Key  Distribution:  Theory, 
Experiment,  and  the  Path  Forward 


Jeffrey  H.  Shapiro  and 

Franco  N.  C.  Wong 

Massachusetts  Institute  of  Technology 
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•  FL-QKD  protocol 

-  low-brightness,  broadband  source  for  key  generation 

-  photon-pair  source  for  security  check 

•  Security  analysis  and  secret-key  rates 

-  security  against  optimum  frequency-domain  collective  attack 

•  Discussion 

-  secret-key  efficiency:  FL-QKD  vs.  state-of-the-art  systems 

•  Preliminary  experiment  with  100  Mbps  modulation 

-  >50  Mbps  secret-key  rate  over  10-dB-loss  channel 

•  Conclusions  and  plans  for  CONQUEST  work 
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Essence  of  Floodlight  QKD 
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•  FL-QKD  is  two-way  CVQKD  with  binary  modulation 

•  Alice  sends  unmodulated,  continuous-wave  (cw)  light  to  Bob 

•  Bob  modulates  and  amplifies  the  light  he  receives  from  Alice 

•  Alice  homodyne  detects  her  received  light  using  a  stored  reference 

•  Low-brightness,  broadband  source  used  for  key  generation 

-  transmit  Ns«  1  photon/mode  for  immunity  to  passive  eavesdropping 
cf.  BB84,  which  transmits  at  most  ~1  photon/bit  to  ensure  security 

-  use  M  »  1  modes/bit  so  that  MNS  »  1  photons/bit  are  transmitted 
cf.  classical  communication,  which  transmits  many  photons/bit 

•  Photon-pair  source  used  for  security  against  collective  attack 

•  Alice  and  Bob’s  channel  monitors  determine  Eve’s  intrusion  parameter 

•  knowing  that  fE  parameter  they  can  bound  her  Holevo  information 
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Floodlight  QKD  Protocol 
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Alice  Eve  Bob 

•  Alic©  s  SPDO  and  ASE  bricjhtn©ss©s.  ^ spdc  Ns  «  1 

•  Alice’s  SPDC  and  ASE  bandwidths:  W 

•  Bob’s  bit  rate:  R=MT«  W  implies  M=  TW»  1  modes/bit 
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Security  Analysis:  SSKUte  Igu .« 

Frequency-Domain  Collective  Attack 


•  Freq-Domain  Collective  Attack 


Alice 


Eve 


Bob 


Freq-Domain  Collective  Attack 

•  Eve  replaces  lossy  fibers  with  lossless 
fibers  and  beam  splitters 

•  Eve  does  (K+ 1  )-mode  unitary 
transformation  of  light  Alice  sent 

•  Eve  transmits  one  output  to  Bob  and 
retains  the  others 

•  Eve  taps  light  from  Bob-to-Alice  channel 
for  joint  measurement  with  light  tapped 
from  Alice-to-Bob  fiber  and  retained  K 
ancillas 


•  Realization  of  optimum  version 


Realization  of  optimum  version 


Bob 
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Eve  replaces  lossy  fibers  with 
lossless  fibers  and  beam  splitters 

Eve  uses  cw  SPDC  source  of 
bandwidth  W 

Eve  injects  signal  light  into  Bob 

Eve  retains  idler  light  for  joint 
measurement  with  light  tapped  from 
Alice-to-Bob  and  Bob-to-Alice  fibers 

fE  =  Eve’s  light  injection  fraction  29 
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Security  Analysis:  Channel  Monitors 


Singles  and  coincidence  rates 


Sa  =  Alice’s  signal-tap  singles  rate 
Sb  =  Bob’s  signal-tap  singles  rate 
Ci a  =  Alice’s  idler  x  signal-tap  time-aligned  coincidence  rate 

Ci  a  —  Alice’s  idler  x  signal-tap  time-shifted  coincidence  rate 
Cjb  =  Alice’s  idler  x  Bob’s  signal-tap  time-aligned  coincidence  rate 

Cjb  =  Alice’s  idler  x  Bob’s  signal-tap  time-shifted  coincidence  rate 


•  Estimating  fE  from  these  rates  •  Preliminary  experiment 


0.12 


measurement  is  calibration  free 


Theory:  Zhuang  etal.,  Phys.  Rev.  A  94,  012322  (2016) 
Experiment:  Zhang  etal.,  Phys.  Rev.  A  95,  012332  (2017) 


0  0.02  0.04  0.06  0.08  0.1 


fs  actual 
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Secret-Key  Rates  (SKRs):  BBN^Technologies  msxam  I“?M  ojS 

Optimum  Frequency-Domain  Collective  Attack 


•  SKR  and  Ns  vs.  path  length  •  SKR  vs .fE  at  50  km 


Secret-Key  Efficiency  (SKE):  BBN  Technologies  i”?™ 

State-of-the-Art  Long-Distance,  High-Rate  Systems 

•  SKE  =  secret-key  rate  in  bits/channel-use 


•  State-of-the-art  for  long-distance,  high-rate  QKD 

•  discrete-variable  QKD  (DVQKD)  •  continuous-variable  QKD  (CVQKD) 


Lucamarini  etal.,  Opt.  Express  2013 


Huang  etal.,  Opt.  Express  2015 


Alice 


OPMj 


decoy-state  BB84  with  1  Gbps  modulation  CVQKD  with  50  Mbaud  modulation 

1  Mbps  secret-key  rate  on  50-km  fiber  link  1  Mbps  secret-key  rate  on  25-km  fiber  link 


•  Lucamarini  etal.:  SKE  =  10'3  bits/channel-use 

•  Huang  et  a\. :  SKE  =  1 .8  x  1 0-3  bits/channel-use 

•  Ultimate  limit  for  10  dB  channel  loss*:  SKE  =  0.15  bits/mode 
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•  1 00  Mbps  modulation,  1 0  dB  propagation-loss  channel 


Optical  fibers 
Electrical  cables 
Optical  links  (theory  only) 
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Je  measured 


Proof-of-Principle  Experiment:  SS-dstsy 
Results 


Coincidence  rates 

xIO5 
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FL-QKD:  A  Practical  Route  to  EEX-ds  lsu  j* 
Gbps  Secret-Key  Rates 

•  FL-QKD  is  two-way  CVQKD  with  binary  modulation 

-  but  its  characteristics  are  very  different  from  current  CVQKD  systems 

•  FL-QKD  attractive  option  for  metropolitan-area  QKD 

-  Gbps  secret-key  rates  at  50  km  possible  without  new  technology 

-  existing  systems  would  require  extensive  WDM  to  do  so 

•  FL-QKD  floods  Alice-to-Bob  fiber  with  many  photons  per  bit 

-  low  brightness  (photons/mode  «  1)  gives  immunity  to  passive  attack 

-  broadband  (modes/bit »  1 )  yields  many  photons/bit  for  high  rate 

-  channel  monitoring  bounds  Eve’s  collective-attack  information 

•  Future  work  —  AFOSR  MURI  and  ONR  CONQUEST  sponsorship 

-  higher-bandwidth  homodyne  receiver  for  Gbps  demonstration 

-  security  analysis  for  coherent  attacks  including  finite-key  effects 

-  protocol  modification  for  higher  secret-key  efficiency 
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FL-QKD  CONQUEST  WORK 
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•  Line-of-sight  atmospheric  path 

-  absorption,  scattering,  and  turbulence  effects 

-  near-field  versus  far-field  power  transfer 

•  Quantum  communication  protocol 

-  QKD  versus  active  +  passive  attack 

-  Direct  communication  versus  passive  attack 

•  Energy-collection  models  for  Eve 

-  All  energy  lost  in  the  quantum  channels 

-  Energy  collected  from  a  realistic  field  of  view 

•  Attack  models 

-  active  +  passive  coherent,  collective,  or  individual  attack 

-  passive  collective  or  individual  attack 
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Preliminary  Results:  lsu  c q 

FL-QKD  Secret-Key  Rates 

•  Lower  bounds  on  ergodic  secret-key  rates  (SKRs) 


FL-QKD  SKRs 

height 

decile 

780  nm  wavelength 

1550  nm  wavelength 

4000  nm  wavelength 

19  m 

10% 

0.809  Gbps 

0.907  Gbps 

0.447  Gbps 

19  m 

50% 

66.75  Mbps 

97.33  Mbps 

72.71  Mbps 

19  m 

90% 

0.721Mbps 

1.50  Mbps 

2.33  Mbps 

30  m 

10% 

2.94  Gbps 

2.66  Gbps 

0.723  Gbps 

30  m 

50% 

0.450  Gbps 

0.585  Gbps 

0.319  Gbps 

30  m 

90% 

9.76  Mbps 

19.66  Mbps 

27.60  Mbps 

50  m 

10% 

4.97  Gbps 

4.04  Gbps 

0.827  Gbps 

50  m 

50% 

1.26  Gbps 

1.43  Gbps 

0.528  Gbps 

50  m 

90% 

30.19  Mbps 

58.83  Mbps 

73.42  Mbps 

-  average  transmissivities:  McBryde  &  Hammel  extinction  + 
turbulence  profiles  and  a  constant-intensity  focused  beam 

-  FL-QKD  SKR  lower  bound:  10  Gbps  modulation,  individual 
passive  attack  with  Eve  using  an  optimum  quantum  receiver  on 
all  the  light  that  doesn’t  reach  its  intended  destination 
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Saikat  /  Kathryn  -  team  introduction,  task  descriptions,  plan:  10  minutes 
Jeff  -  Security  analysis  w/  realistic  eavesdropping  assumptions:  15  minutes 
Jeff  /  Franco  -  Flood  light  QKD:  theory  and  experiments:  15  minutes 
Kamil  -  security  proof  for  discrete  modulation  CV  QKD:  15  minutes 
Saikat  -  efficient  post-processing  for  CV  QKD:  15  minutes 
Mark  -  Finite  key-length  analysis  for  QKD:  15  minutes 
Darius  /  Dirk  -  PIC  based  transmitters  and  receivers  for  QKD:  15  minutes 
Saikat  -  Free-space  quantum  networking  /  wrap  up  - 15  minutes 
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Gaussian  CVQKD 

o 


Security  and  key  rates  for  non-Gaussian  CVQKD  Achieved  results 

oo  oooo 


A  non-Gaussian  CVQKD  protocol  for  three 

signal  states 


Kamil  Bradler,  Christian  Weedbrook 


CipherQ 
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Gaussian  CVQKD 


Security  and  key  rates  for  non-Gaussian  CVQKD  Achieved  results 

oo  oooo 


Continuous-variable  QKD 


v  Continuous  equivalent  of  DVQKD 

v  Secret  key  encoded  in  the  complementary  observables 
X  andP 


v  Advantages:  high  bit  rates,  experimental  realization 

v  Disadvantages:  Security  analysis  not  as  mature  as  for  DVQKD, 
classical  postprocessing  slow 

v  Main  focus  so  far:  Gaussian  CVQKD  -  Gaussian  states  chosen 
with  a  Gaussian  prior  in  phase  space 

v  Only  in  that  case  the  adversary’s  (Eve)  most  general  attack  is 
known  -  a  Gaussian  operation 

v  How  about  Gaussian  states  chosen  discretely? 

v  Advantages:  HW  and  random  number  generation  simpler 


M 


A  few  discrete  states  suspected  to  quickly  approach  Gaussian 

modulation  Revie*  Meeting 
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Gaussian  CVQKD 

o 


Security  and  key  rates  for  non-Gaussian  CVQKD  Achieved  results 

•o  oooo 


Binary  modulated  CVQKD 


v  The  signal  states  are  Gaussian  (coherent  states  |a0),  la^))  with 
Po=Pi  =  l/2 

v  The  signals  are  sent  down  a  quantum  channel  in  order  to 
establish  private  classical  correlations  (secret  key) 

v  Eves  best  strategy  is  unknown 

v  Nothing  is  assumed  about  the  adversary  except  that  the  attack 
is  collective  and  the  protocol  asymptotic 

v  A  formula  for  a  lower  bound  on  the  secret  key  provided 

v  It  only  depends  on  easily  measurable  quantities 

v  Calculated  for  a  lossy  bosonic  channel  (rate  a  fen  of  a  channel 
transmissivity) 


Zhao  et.  al.  PRA  79,  012307  (2009) 
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Gaussian  CVQKD 

o 


Security  and  key  rates  for  non-Gaussian  CVQKD  Achieved  results 

om  oooo 


Ternary  modulated  CVQKD 


v  Main  object  of  study  is  the  following  density  matrix 

A  =  Pola0><a0|  +Pi|ai)(a1|  +p2\a2){a2\ 

v  Po  —  Pi  —  P2  —  1/3  and  a{  are  coherent  signal  states 

v  Three  and  more  signals  are  qualitatively  different  from  the 
two-signal  case 

v  Even  if  we  choose  symmetric  \at)f  Eves  states  ^  conditioned 
on  Bobs  announcement  Y  (public)  are  not  guaranteed  to 
satisfy  the  imposed  symmetries 

v  In  addition,  a  major  technical  roadblock  ahead 
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Gaussian  CVQKD 

o 


Security  and  key  rates  for  non-Gaussian  CVQKD  Achieved  results 

oo  •ooo 


Entropy  calculations 


v  Lets  follow  the  binary  proof  strategy  as  much  as  we  can 
v  The  key  rate  is  obtained  by  maximizing 

H(E\X)e+H(X:E)e-H(E\Y)e 

H(E\Y)  =  XyPyHien) 

v  ForH(X :  E )  one  diagonalizes 

1 

i Qe  =  r(lao)(aol  +  l«i)(«il  +  la2)(a2l) 
v  For  H(E\Y)  it  is 

QyE =p(o[y)|-«/’o)(V^I  +p(  i[y)l^i)<^il  +p(2|y)IV^)W,2 
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Gaussian  CVQKD 

o 


Security  and  key  rates  for  non-Gaussian  CVQKD  Achieved  results 

oo  o#oo 


Entropy  calculations 


v  No  brute-force  diagonalization  but  instead  the 
Cayley-Hamilton  theorem  was  used 

v  The  coeffs  in  f(x)  =  a3x 3  +  a2x 2  +  axx  +  a0  are  given  by 
S„Tr[^] 

v  The  eigenvalues  depend  on  Eves  states 

=Zy  ec 

v  In  order  to  see  whether  the  calculation  is  manageable  we  set 
ztj  =  z  e  (0, 1)  (ignoring  the  phase) 

v  To  restore  full  generality,  the  phase  will  be  added  or  argued  to 
be  irrelevant 

v  For  now  gyE  is  a  function  of  2  and  p(k\y),y  =  {0, 1, 2} 
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Gaussian  CVQKD 

o 


Security  and  key  rates  for  non-Gaussian  CVQKD  Achieved  results 

oo  oo#o 


Monotonicity  and  concavity  of  h3 


v  The  second  major  step  was  to  show  that  H(q^)  is 
monotone-decreasing  and  concave  in  %  for  all p(k\y) 

v  The  main  ingredients  to  lower  bound  the  secret  key  rates 

v  The  original  paper  analyzed  the  binary  Shannon  entropy  for 

0<u<  1/2 

H(eyE)  =  h2(u{z;p))  =  -u  logu  -  (1  -  u)  log  [1  -  u] 
v  We  study  the  ternary  Shannon  entropy 

h3(u(z;p))  =  -ux  log Ui  ^2  logu2-(l-ifi-u2)log[l  -ux  -u2] 

v  There  is  a  HUGE  difference  between  h2  and  h3 
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Gaussian  CVQKD 

o 


Security  and  key  rates  for  non-Gaussian  CVQKD  Achieved  results 

oo  ooo# 


Monotonicity  and  concavity  of  h3 


v  We  showed  that  h3  is  monotone-decreasing  and  concave  in  2 
forallp(fc|y) 
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Saikat  /  Kathryn  -  team  introduction,  task  descriptions,  plan:  10  minutes 
Jeff  -  Security  analysis  w/  realistic  eavesdropping  assumptions:  15  minutes 
Jeff  /  Franco  -  Flood  light  QKD:  theory  and  experiments:  15  minutes 
Kamil  -  security  proof  for  discrete  modulation  CV  QKD:  15  minutes 
Saikat  -  efficient  post-processing  for  CV  QKD:  15  minutes 
Mark  -  Finite  key-length  analysis  for  QKD:  15  minutes 
Darius  /  Dirk  -  PIC  based  transmitters  and  receivers  for  QKD:  15  minutes 
Saikat  -  Free-space  quantum  networking  /  wrap  up  - 15  minutes 


Review  Meeting 
February  17,  2017 


47 


Communications  and  Networking  with  Quantum  Operational  ly- 


Secure  Technology  for  Maritime  Deployment  (CONQUEST) 

1 

Efficient  post-processing  for  CV  QKD 

Saikat  Guha 
BBN 
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•  Free-space  QKD:  near-to-far  field  transition 

-  Rate-vs.-loss  of  direct  transmission  QKD  protocols 

-  Multiple  spatial  modes  to  maximize  rate  for  short-range 
deployment 

*  Continuous  variable  QKD 

-  Efficient  post-processing  methods  for  CV  QKD 

•  Discrete  modulation  with  guard  band  post  processing 

•  Floodlight  QKD  and  block  post  processing  for  CV  QKD 


Review  Meeting 
February  17,  2017 


49 


Outline 


Raytheon  r]p  I  Cl 

BBN  Technologies 


Q 

CIPHER  Q 


•  Free-space  QKD:  near-to-far  field  transition 

-  Rate-vs.-loss  of  direct  transmission  QKD  protocols 

-  Multiple  spatial  modes  to  maximize  rate  for  short-range 
deployment 

*  Continuous  variable  QKD 

-  Efficient  post-processing  methods  for  CV  QKD 

•  Discrete  modulation  with  guard  band  post  processing 

•  Floodlight  QKD  and  block  post  processing  for  CV  QKD 
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Rate-vs.-loss  for  direct-transmission  QKD 


— TGW  upper  bound 
^ultimate  limit 

—  ideal  single-photon  BB84 

—  ideal  CV  QKD 

—  ideal  decoy-state  BB84 

—  CV  QKD  (imperfect  devices) 
""“decoy-state  BB84  (imperfect  devices) 


2.89 7]  bits/mode 


oka,  Guha,  Wilde,  Nature 
Ccm|imunications,  5,  5235,  (2014) 
1 


Cs=-~  log 


r)  ~  e 

fiber 


rj  ~  1/Zr  0 

free-space 


10 


■/?-  =  - 0:9- v  V= 

l'';l  )./>,.,<  -  1.1\ 

i  . 

Gaussian  modulation  BB84-decoyv 


1—7] 

Pirandola,  Laurenza, 
Ottaviani,  Banchi, 
arXiv:1 51 0.08863,  2015 


1.44  7] 


20  30  40 

loss  in  dB  10  log10  (1  / ^7) 
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R( key  rate  in  bits/s) 
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Focused  beams 

-  Multiple  spatial  modes  can  help 
at  short  ranges:  higher  rate 
improvement  at  shorter 
wavelengths  (more  modes) 

-  Don’t  quite  need  orthogonal 
(e.g.,  OAM)  modes;  overlapping 
focused  beams  work  pretty  well 

rt  —  rr  —  7  cm 
A  =  1.55/im 

Pd  =  10“6 
v  =  10GHz 
V  =  0.99 


Co-funded  by  Sandia 
National  Laboratory 


Bash,  Chandrasekaran, 
Shapiro,  Guha, 
arxiv:1 604.08582 


io  \ 

L (range  in  km) 
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.-V'  J** 


Cs  =  log2(l  -  if) 
1.44??  bits/modj 


single  pixel  (1x1) 

i 

i 

i 

i 


d-s  BB84  on  OGBAwith  optimal 
paerture  geometries  indicated. 
Transmitter  and  receiver  apertures 
have  same  area  as  Gaussian  and 
hard  apertures  for  LG  modes. 
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•  Free-space  QKD:  near-to-far  field  transition 

-  Rate-vs.-loss  of  direct  transmission  QKD  protocols 

-  Multiple  spatial  modes  to  maximize  rate  for  short-range 
deployment 

*  Continuous  variable  QKD 

-  Efficient  post-processing  methods  for  CV  QKD 

•  Discrete  modulation  with  guard  band  post  processing 

•  Floodlight  QKD  and  block  post  processing  for  CV  QKD 


Review  Meeting 
February  17,  2017 


53 


CV  QKD:  status  of  security  proofs 

•  What  do  we  mean  by  a  “QKD  protocol  is  secure”? 

-  Work  in  the  equivalent  “entanglement  based”  picture  (vs.  P&M) 


1 

PANBN  7 >  PKaKbE 


1 


s£{0,l} 


-  Everyone  calculates  this:  iCTP  =  “ax  \(3I(A-  B)  -  X(B,  E)}  x  W 

Ns 

-  Gaussian  modulation:  security  against  collective  attacks  proven 
[Leverrier,  2015],  and  K^n(N)  «  K^mp  for  N  ~  1010  -  1014 

-  Only  two  parameters  (loss  and  noise)  need  to  be  estimated 

-  But  no  useful  finite-length  key-rate  LB,  i.e.,  Ke(N)  >  0 

•  Discrete-modulation  (2-state  and  4-state):  ^Con"'P  known,  but  is  not  54 
proven  to  be  achievable:  optimal  “attack”  not  known 


CV  QKD:  status  of 
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•  Input  power,  reconciliation  efficiency,  constellation  cardinality 


^c“nmP  =  [^(-4;  B)  ~  x(B,  E)]  x  W 

Ns 

-  I(A;B)  -x(B;E)  ->  (optimal)  const.  Ns  ->  (3<1,  optimal  Nsgoes  down 

-  Good  ECC  (high  (3)  at  low  Ns  hard  to  achieve: 

•  (1)  recent  progress  (p  ~  0.96:  multi-edge  LDPC  codes,  Gaussian  mod.) 

•  (2)  discrete  constellation:  high  p  easier;  simpler  transmitter  (no  need  for  Gaussian 
when  Ns  small),  PP  overhead,  may  get  better  range,  “0”  hitting 

-  Short  distances  (low  loss):  High  Ns  better  -  multi-state  constellation 


Post-processing  overhead  vs.  key  rate 


key  distillation 


announcement 

-  Every  single  mode  generates  “data”  that  gets  fed  into  post-processing:  unlike 
in  DV  QKD,  only  n  fraction  of  modes  generates  clicks 

-  When  the  channel  is  lossy,  do  we  really  need  to  feed  data  from  each  det^ted 
mode  into  post-processina  (kev  map)? 


Secret  key  bits  per  mode 
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CIPNE-1Q 


Discrete  4-state  modulation  (iCX115) 


0.001 


0 


Ns  =  0.125  photons/mode 

(3  =  0.8 

Vd  =  0.6 


£  (excess  noise  in  shot  noise  units) 


Leverrier  and  Grangier 


_  0.002 
0.004 


arXiv:1002.4083v2  [quant-ph] 
PRL102, 180504  (2009) 


0.01 

I 


0.008 


L  (km) 


50 


100 


150 


200 


250 


If  we  assume  “linear”  channel,  collective-attack  security  known 
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•  BPSK  coherent  state  modulation  +  heterodyne 

-  Rate  lower  bound  known  with  general  collective  attack 


Il±a 


Alice 


±  Vva) 

Bob 


y  =  (yuV2) 


Eve 


|  ±  x/1  -  m) 

-  Key  map:  (Announcement,  Discretization) 


Zhao,  Heid,  Rigas,  Lutkenhaus, 
PRA  79,  012307  (2009) 

P[£  =  1]  =  e  =  -erfc(  Y//27/|ce|2) 

Zj 


•  Discretization  =  sign(yi)  ->  gets  fed  into  post-processing 

•  Announcement  =  (\y\ |,  2/2) 

—  The  noise  “bin  index”  u  —  \y\  \  requires  infinite  precision 
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Trade  rate  with  post-processing  overhead 


Q 

CIPHER  Q 


•  Key  results  so  far: 


-  Optimal  key  map  for  BPSK  +  Heterodyne  for  noiseless  lossy  channel 

-  2-bin  PP  (get  rid  of  the  infinite-res  bin  index  entirely) 

-  3-bin  PP  (1  bit  bin-index):  nothing  to  announce  on  a  large  fraction  of  modes 

-  “Biased  basis”  version  of  BPSK  CV  QKD 


Channel  loss  [in  dBl 
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Discrete  modulation:  ongoing  work 


Q 

CIPHER  Q 


•  Table-top  FSO  experiment  for  BPSK  CV  QKD 

•  Potential  paths  to  rate  LB  with  finite  constellations 

-  Extending  Zhao  et.  al.’s  technique  (Kamil  Bradler,  Christian 
Weedbrook) 

-  Extending  Fabian  Furrer’s  Entropic  Uncertainly  techniques 

-  Extending  IQC  numerical  technique  (Patrick  Coles,  Norbert 
Lutkenhaus) 

-  Anthony  Leverrier’s  CV-decoy  ideas  (don’t  work  in  current  form) 

•  Constellation  cardinality  that  achieves  “pretty  much”  the 
performance  of  Gaussian  modulation  at  a  given  channel  loss 

•  Key  rate  LB  with  finite  key  length  (Mark  Wilde,  Saikat  Guha) 

Note:  No  modulation  is  “Gaussian”  due  to 
finite  extinction  ratio  of  EOMs  and  finite 
RNG  (it  is  always  a  discrete  modulation) 
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Block  post-processing 
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•  If  Bob  employs  a  M-length  block  of  raw  data  in  a  repetition  code, 
SNR  roughly  becomes  M  fold  higher 

•  (Bits  per  M-length-symbol)  /  M  =  bits/mode  not  much  worse  than  M 
=  1  bits/mode,  but  could  save  PP  overhead,  achieve  better  |3 

•  This  idea  of  an  inner  repetition  code  (or  block  post-processing)  was 
first  proposed  by  Leverrier  and  Grangier  in  (PRL 102, 180504,  2009) 
for  CV  QKD  with  2-PSK  and  4-PSK 

0.99  0.82  -0.04  1.53  -0.91  -0.94  0.41  0.97  -0.29  -1.49  0.37  -0.02- 

1.02  -1.06  -0.26  0.69  -0.81  0.77  -2.65  -0.65  -1.02  1.06  -0.26  0.69... 

-  Instead  of  Bob  announcing  the  sign  of  each,  he  announces  the 

sign  of  the  first  measurement  in  a  (k=4)  block  relative  to  the 
others  in  the  block 

1,1, -1,1,  1,1, -1,-1,  1,1, -1,1,  1,1, 1,-1,  1,-1,  U,  1,-1, 1,-1,  ... 

-  Reverse  reconciliation  version  of  M=4  repetition  code  (1 ,1 ,1 ,1  vs. 

-1,-1, -1,-1) 
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Block  post-processing  vis-a-vis  FL-QKD 


Q 

CIPHER  Gl 


10 


cu 

"d 

o 


CQ 


Alice  uses  a  THz  optical  BW  source,  Bob  uses  a  GHz  BW  binary 
phase  modulator  (block  length  M  ~  1000),  THz  modes/sec 

Proposed  by  Jeff  Shapiro  et  al. 
arXiv:1 607.00457 

•  Leverages  block  post-processing 

•  Two-way  channel  (reverse  optical 
channel  only  for  a  practical  purpose) 

•  ^conmP^nown’  Ke(N)  =? 

M-mode 


10 


-5 


10 


-10 


SPDC 


N 


E 


±1 


o 


20  40  60 

loss  in  dB  101og10(l/7/) 


E 
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CV  QKD  with  block 
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post-processing 


Q 

CIPHER  Q 


•  FL-QKD  (almost)  mathematically  equivalent  to 
standard  Gaussian  modulated  CV  QKD  with  a  block 
post-processing,  but  with  a  HUGE  modes/s  advantage 

•  Proving  security  (Ke(N )  =?)  of  CV  QKD  with  this  new 
key  map  may  prove  security  for  FL-QKD  and  vice 
versa 

Heterodyne 

Guha,  Takeoka;  work  in 
progress,  unpublished 
(2017) 

|TMSV) 


z  =  ±i(j7)  +  ft 
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Saikat  /  Kathryn  -  team  introduction,  task  descriptions,  plan:  10  minutes 
Jeff  -  Security  analysis  w/  realistic  eavesdropping  assumptions:  15  minutes 
Jeff  /  Franco  -  Flood  light  QKD:  theory  and  experiments:  15  minutes 
Kamil  -  security  proof  for  discrete  modulation  CV  QKD:  15  minutes 
Saikat  -  efficient  post-processing  for  CV  QKD:  15  minutes 
Mark  -  Finite  key-length  analysis  for  QKD:  15  minutes 
Darius  /  Dirk  -  PIC  based  transmitters  and  receivers  for  QKD:  15  minutes 
Saikat  -  Free-space  quantum  networking  /  wrap  up  - 15  minutes 
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o  Given  a  quantum  channel  A f  and  a  quantum  key  distribution  (QKD)  protocol  that 
uses  it  n  times,  how  much  key  can  be  generated? 
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Setup  I 


o  Given  a  quantum  channel  A f  and  a  quantum  key  distribution  (QKD)  protocol  that 
uses  it  n  times,  how  much  key  can  be  generated? 


•  Ideal  secret  key: 


Approximate  secret  key:  A  state  pabe  is  an  £-close  secret  key  if 
F(pabe ,  &AB  &  cte )  >  1  —  e,  where  F  denotes  quantum  fidelity. 

<  □  ►  <  S  ►  <  -1  ►  <  1  >  1  >0  0,0 
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Setup  II 


•  Non-asymptotic  private  capacity:  maximum  rate  of  s-close  secret  key  achievable 
using  the  channel  n  times  with  two-way  classical  communication  (LOCC)  assistance 


P$(n,  e)  sup  {P  :  (n,  P ,  e)  is  achievable  for  M  using  LOCC}  .  (2) 


Mark  M.  Wilde  (LSU) 


:  □  :  <  -E  ►  <  ■==  >  -E  '0^0' 


Converse  bounds  for  private  communication 


February  17,  2017  3  /  16 


Setup  II 


•  Non-asymptotic  private  capacity:  maximum  rate  of  s-close  secret  key  achievable 
using  the  channel  n  times  with  two-way  classical  communication  (LOCC)  assistance 


Pff(n,  s)  :=  sup  {P  :  (n,  P ,  e)  is  achievable  for  M  using  LOCC}  .  (2) 


o  The  idea  is  to  fix  n  >  1  and  £  G  (0, 1)  and  then  determine  how  large  the  secret  key 
rate  can  be. 
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o  Practical  question:  how  to  characterize  Pff(n,e)  for  all  n  >  1  and  5  E  (0,1)? 
The  answers  give  the  fundamental  limitations  of  QKD. 


Practical  question:  how  to  characterize  Pp{n,e)  for  all  n  >  1  and  e  E  (0,1)? 
The  answers  give  the  fundamental  limitations  of  QKD. 


Upper  bounds  on  Pff(n,e)  can  be  used  as  benchmarks  for  quantum 
repeaters  [Lutkenhaus]. 


Practical  question:  how  to  characterize  Pp{n,e)  for  all  n  >  1  and  e  E  (0,1)? 
The  answers  give  the  fundamental  limitations  of  QKD. 

Upper  bounds  on  Pff(n,e)  can  be  used  as  benchmarks  for  quantum 
repeaters  [Lutkenhaus]. 

Today,  I  will  present 

the  tightest  known  upper  bound  on  PjJ(n,s) 


for  several  channels  of  practical  interest.  Interesting  special  case:  single-mode 
phase-insensitive  bosonic  Gaussian  channels. 


Overview 


Q  Main  Results  (Examples) 


9  Proof  Idea:  Meta  Converse 


Main  Result:  Gaussian  Channels  I 


o  Converse  bounds  for  single-mode  phase-insensitive  bosonic  Gaussian  channels, 
most  importantly  the  photon  loss  channel 

Cv:  b  =  y/rja  +  y/l  -  r/e  (3) 

where  transmissivity  77  E  [0,1]  and  environment  in  vacuum  state. 
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Main  Result:  Gaussian  Channels  I 


o  Converse  bounds  for  single-mode  phase-insensitive  bosonic  Gaussian  channels, 
most  importantly  the  photon  loss  channel 

Cv:  b  =  y/rja  +  y/l  -  r/e  (3) 

where  transmissivity  77  E  [0,1]  and  environment  in  vacuum  state. 

9  Our  approach  gives  a  complete  proof  for  the  following  weak  converse  bound, 
stated  in  [Pirandola  et  al.  2016]: 

P~(£„)  :=  lim  Jim  ^(n,e)  <  >  (4) 

which  is  actually  tight  in  the  asymptotic  limit,  i.e. ,  P^(CV)  =  log  f  ■ 
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Main  Result:  Gaussian  Channels  I 


o  Converse  bounds  for  single-mode  phase-insensitive  bosonic  Gaussian  channels, 
most  importantly  the  photon  loss  channel 

Cv:  b  =  y/rja  +  y/l  -  r/e  (3) 

where  transmissivity  77  E  [0,1]  and  environment  in  vacuum  state. 

9  Our  approach  gives  a  complete  proof  for  the  following  weak  converse  bound, 
stated  in  [Pirandola  et  al.  2016]: 

1 


,)  :=  lim  lim  P£(n,e)  <  log 


V 


£  — y  0  n—yoo 

which  is  actually  tight  in  the  asymptotic  limit,  i.e.,  P^(CV)  = 
The  weak-converse  bound  follows  from  a  finite-length  bound: 

log(i^)  +2/7  2(s)/n 


(4) 


P?„(n,e)< 


(1  -  8s) 


(5) 
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Main  Result:  Gaussian  Channels  I 


9  Converse  bounds  for  single-mode  phase-insensitive  bosonic  Gaussian  channels, 
most  importantly  the  photon  loss  channel 

Cv:  b  =  y/rja  +  y/l  -  r/e  (3) 

where  transmissivity  77  E  [0,1]  and  environment  in  vacuum  state. 

9  Our  approach  gives  a  complete  proof  for  the  following  weak  converse  bound, 
stated  in  [Pirandola  et  al.  2016]: 

1 


V 


(4) 


which  is  actually  tight  in  the  asymptotic  limit,  i.e.,  P^(CV)  = 
The  weak-converse  bound  follows  from  a  finite-length  bound: 

log(i^)  +2/7  2(s)/n 


PZ(n,e)< 


(1  -  8s) 

9  Drawback:  an  asymptotic  statement,  and  thus  says  little  for  practical 
protocols  (called  a  weak  converse  bound). 


(5) 


^  'T)  <\(y 
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Main  Result:  Gaussian  Channels  II 


We  show  the  non-asymptotic  converse  bound 


p?>E>s'»8(rb;)  +  ®.  (6) 


where  C(s)  :=  log  6  +  2  log (  j  (other  choices  possible). 


Main  Result:  Gaussian  Channels  II 


•  We  show  the  non-asymptotic  converse  bound 

PK,(»,e)<log(T^)  +  ®,  (6) 

where  C(s)  :=  log  6  +  2  log^^|^  (other  choices  possible), 
o  This  bound  implies  the  strong  converse:  lim^oo  P£(n,e)  <  log 
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Main  Result:  Gaussian  Channels  II 


•  We  show  the  non-asymptotic  converse  bound 

PK,(»,e)<log(T^)  +  ®,  (6) 

where  C(s)  :=  log  6  +  2  log^^|^  (other  choices  possible). 

o  This  bound  implies  the  strong  converse:  lim^oo  P^{n,e)  <  log^— 

9  Can  be  used  to  assess  the  performance  of  any  practical  quantum 
repeatei  which  uses  a  loss  channel  n  times  for  desired  security  5. 
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Main  Result:  Gaussian  Channels  II 


•  We  show  the  non-asymptotic  converse  bound 

PK,(»,e)<log(T^)  +  ®,  (6) 

where  C(s)  :=  log  6  +  2  log^^|^  (other  choices  possible). 

o  This  bound  implies  the  strong  converse:  lim^oo  P^{n,e)  <  log^— 

9  Can  be  used  to  assess  the  performance  of  any  practical  quantum 
repeatei  which  uses  a  loss  channel  n  times  for  desired  security  5. 

9  Other  variations  of  this  bound  are  possible  if  77  is  not  the  same  for  each 
channel  use,  if  ij  is  chosen  adversarially,  etc. 
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Main  Result:  Gaussian  Channels  II 


•  We  show  the  non-asymptotic  converse  bound 

PK,(»,e)<log(T^)  +  ®,  (6) 

where  C(s)  :=  log  6  +  2  log^^|^  (other  choices  possible). 

o  This  bound  implies  the  strong  converse:  lim^oo  P^{n,e)  <  log^— 

9  Can  be  used  to  assess  the  performance  of  any  practical  quantum 
repeatei  which  uses  a  loss  channel  n  times  for  desired  security  5. 

9  Other  variations  of  this  bound  are  possible  if  77  is  not  the  same  for  each 
channel  use,  if  ij  is  chosen  adversarially,  etc. 

9  We  give  similar  bounds  for  the  quantum-limited  amplifier  channel  (tight), 
thermalizing  channels,  amplifier  channels,  and  additive  noise  channels. 

4  □  >  <1  gp  >  <  ►  4  =  >T)  C \  O 
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Secret  key  rate  (bits  per  mode) 


Fundamental  rate-loss  trade-off  from  [TGW14] 


Channel  loss  in  dB  (=-10log wrj) 

Can  translate  x-axis  to  km  by  assuming  fiber  has  0.2  dB  loss  /  km 

<  □  .  <  g  ►  4  1  ►  ◄  1  ►  1  >0  0,0 
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Main  Result:  Dephasing  Channels  I 


o  Asymptotic  result  [Pirandola  et  al.  2016]  for  the  qubit  dephasing  channel 

Z1\  (l-n/)p  +  n/ZpZ 


with  7  G  (0, 1)  is 


PH(2 7)  :=  lim  lim  P£  (n,e)  =  1  -  h{i) , 

£ — >-0  n—t oo  7 

with  the  binary  entropy  /?( 7)  :=  —7  log 7  —  (1  —  7)  log(l  —  7). 


(7) 


Main  Result:  Dephasing  Channels  I 


o  Asymptotic  result  [Pirandola  et  al.  2016]  for  the  qubit  dephasing  channel 

Z1\  (l-n/)p  +  n/ZpZ 


with  7  G  (0, 1)  is 

PH(2 7)  :=  lim  lim  P%  {n,e )  =  1  -  h{y) ,  (7) 

£ — >-0  n—t oo  7 

with  the  binary  entropy  /?( 7)  :=  —7  log 7  —  (1  —  7)  log(l  —  7). 


q  By  combining  with  [Tomamichel  et  al.  2016]  we  show  the  expansion 


with  0  the  cumulative  standard  Gaussian  distribution  and  the  binary  entropy 
variance  1/(7)  :=  7(log7  +  h{ 7))2  +  (1  —  7)(log(l  —  7)  +  /?(7))2. 
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Main  Result:  Dephasing  Channels  II 


9  For  the  dephasing  parameter  7  =  0.1  we  get  (figure  from  [Tomamichel  et  al. 
2016]): 


(c)  Comparison  of  strict  bounds  with  third  order 
approximation  for  e  =  5%. 

:  □  ifp  <  |  ►  ^  |  B  'OQlCv 
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Proof  Idea:  Meta  Converse  I 


o  Vleta  converse  approach  from  classical  channel  coding  [Polyanskiy  et  al.  2010], 
uses  connection  to  hypothesis  testing.  In  the  quantum  regime,  e.g.,  for  classical 
communication  [Tomamichel  &  Tan  2015]  or  quantum  communication  [Tomamichel 
et  al.  2014  &  2016].  We  extend  this  approach  to  private  communication. 
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Dh(p\\ct)  :=  -  log  inf  {  Tr[Aa]  :  0  <  A  <  /  A  Tr[Ap]  >  1  -  e)  .  (9) 
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Proof  Idea:  Meta  Converse  I 


o  Vleta  converse  approach  from  classical  channel  coding  [Polyanskiy  et  al.  2010], 
uses  connection  to  hypothesis  testing.  In  the  quantum  regime,  e.g.,  for  classical 
communication  [Tomamichel  &  Tan  2015]  or  quantum  communication  [Tomamichel 
et  al.  2014  &  2016].  We  extend  this  approach  to  private  communication. 

o  Hypothesis  testing  relative  entropy  defined  for  a  state  p,  positive  semi-definite 
operator  a,  and  £  £  [0, 1]  as 

Dh(p\\ct)  :=  -  log  inf  {  Tr[Aa]  :  0  <  A  <  /  A  Tr[Ap]  >  1  -  e)  .  (9) 

9  The  e-relative  entropy  of  entanglement  is  defined  as 

Er{A\  B)p  :=  inf  DeH(pAB \\ctab)  ,  (10) 

& AB  Go(/\.£5J 


where  S(A  :  B)  is  the  set  of  separable  states  (cf.  relative  entropy  of  entanglement). 

Channel’s  e-relative  entropy  of  entanglement  is  then  given  as 


E|(A0  :=  sup  E|(4;  B)p , 

(11) 

1  ^)AA'enAA' 

where  pAB  :=  NA'^b(^aa')- 

4  □  ►  :  & 1  ■ 

<  =  'O^O 
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Proof  Idea:  Meta  Converse  II 


o  Goal  is  the  creation  of  og  K  bits  of  key,  i.e.,  states  7 abe  with 

(Ma  ®  Mb){'Jabe )  =  ^  I i)(i\A  0  |/)(/|e  ®  crE  (12) 


for  some  state  aE  and  measurement  channels  Ma,  Mb- 


Proof  Idea:  Meta  Converse  II 


o  Goal  is  the  creation  of  og  K  bits  of  key,  i.e.,  states  7 abe  with 

(Ma  0  Mb){'Jabe )  =  ^  I i)(i\A  0  |/)(/|e  0  oe  (12) 


for  some  state  aE  and  measurement  channels  Ma,  Mb- 

®  In  one-to-one  correspondence  with  pure  states  7 aa'bb'e  such  that 
[Horodecki  et  al.  2005  &  2009] 


7 ABA'B'  =  UaBA'B'^AB  0  @A'B')U\BA,B,  ,  (13) 


where  maximally  entangled,  U aba'B'  =  J2ij  I0(/’U  0  l/) 01b  0  U'hB'  with 
each  UA,B,  a  unitary,  and  a  state. 


Proof  Idea:  Meta  Converse  II 


o  Goal  is  the  creation  of  og  K  bits  of  key,  i.e.,  states  7 abe  with 
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for  some  state  aE  and  measurement  channels  Ma,  Mb- 

®  In  one-to-one  correspondence  with  pure  states  7 aa'bb'e  such  that 
[Horodecki  et  al.  2005  &  2009] 


7 ABA'B'  =  UaBA'B'^AB  0  @A'B')U\BA,B,  ,  (13) 


where  maximally  entangled,  U aba'B'  =  J2ij  l')('U  0  U ) 0 1 e  0  U'hB'  with 
each  UA,B,  a  unitary,  and  Oa'B'  a  state. 

o  Work  in  the  latter,  bipartite  picture. 


Proof  Idea:  Meta  Converse  III 


o  Let  s  G  [0, 1]  and  let  Paba'b'  be  an  ^-approximate  7-private  state.  The  probability 
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Tr{n aba'b'O'aa'bb'}  <  ,  (15) 

o  The  monotonicity  of  the  channel’s  e-relative  entropy  of  entanglement  EB(J\T)  with 
respect  to  LOCC  together  with  (15)  implies  the  neta  converse 


Pj^{ l,e)  <  Er(AT)  (LOCC  pre-  and  post- processing  assistance).  (16) 


For  n  channel  uses  this  gives  Pj^(n,£)  <  ^EB(Af®n)  . 

9  Finite  block-length  version  of  relative  entropy  of  entanglement  upper  bound 
[Horodecki  et  al.  2005  &  2009]. 

9  One  can  then  evaluate  the  meta  converse  for  specific  channels  of  interest. 
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o  Our  meta  converse  P^f(l,s)  <  Er(AT)  gives  bounds  for  the  private  transmission 
capabilities  of  quantum  channels.  These  give  the  fundamental  limitations  of  QKD 
and  thus  can  be  used  as  benchmarks  for  quantum  repeaters. 

o  Can  our  bound  be  improved  for  the  photon  loss  channel 

P£v(n,£)  <  los(;jr~)  +  ~~  with  C(e)  =  log6  +  2log(i^_£)  (17) 

to  C\e)  ■=  log^)? 

o  Corresponding  matching  achievability?  (Tight  analysis  of  random  coding  in  infinite 
dimensions  needed.) 

o  Tight  finite-energy  bounds  for  single-mode  phase-insensitive  bosonic  Gaussian 
channels? 

9  Understand  more  channels,  for  example  such  with  P **  >  0  but  zero  quantum 
capacity  [Horodecki  et  al.  2008]? 


Plan  forward 


o  We  suspect  it  should  be  possible  to  use  the  technique  of  Muller-Hermes  et  al.  in 
arXiv:  1604.03448  to  derive  bounds  for  protocols  using  finite  energy.  This  would  give 
tighter  bounds. 


o  We  are  generalizing  these  upper  bound  methods  such  that  they  could  apply  more 
specifically  to  floodlight  quantum  key  distribution  (work  in  progress) 


o  We  are  working  on  applying  these  bounds  to  particular  protocols  commonly  used  in 
quantum  key  distribution 
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Extra:  Gaussian  Formulas 


9  For  Gaussian  channels  we  need  formulas  for  the  relative  entropy  D(p\\a)  and  the 
relative  entropy  variance  V(p\\a). 

9  From  [Chen  2005,  Pirandola  eta/.  2015]  and  [Wilde  eta/.  2016],  respectively: 
writing  zero-mean  Gaussian  states  in  exponential  form  as 


p  —  Zp  1//2  exp  |  —  ^xtG/9x|  with  (18) 

Zp  :=  det(Vp  +  /ft/2),  Gp  :=  2/ft  arcoth(2\/p/ft) ,  (19) 

and  Vp  the  Wigner  function  covariance  matrix  for  p,  we  have 


D(P\W)  =  1 

(,og(|)-T„AVn) 

(20) 

V(p\\a)  =  1 

Tr{A  VPA\/P}  +  i  Tr{AQAO}  , 

8 

(21) 

where  A  :=  Gp  —  Ga. 


4  □  '  |fp  <  -  ►  <  ,=  ►  S  >0  0^0 


Mark  M.  Wilde  (LSU)  Converse  bounds  for  private  communication  February  17,  2017  16  /  16 


Raytheon  r]p  I  Cl 

BBN  Technologies  msM^ 


Q 

CIPHER  Q 


Saikat  /  Kathryn  -  team  introduction,  task  descriptions,  plan:  10  minutes 
Jeff  -  Security  analysis  w/  realistic  eavesdropping  assumptions:  15  minutes 
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Chip-based  quantum  key  distribution 
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•  High-dimensional  temporal  QKD:  optimization  of 
secret  key  capacity 

•  Chip-based  Tx/Rx  for  maritime  QKD: 

-  Programmable  dispersion  for  HD-QKD  and  dynamic 
dispersion  control 

-  Chip  design  for  adaptive  transmitters  and  receivers 

-  Polarization-based  QKD 

•  Summary 
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•  QKD,  at  short  distances,  is  limited  by  detector  saturation 
(and/or  source  brightness) 


High-dimensional  QKD  protocol 
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Boston-area  quantum  network  testbed 
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43-km  deployed  fiber 

Loss  (dB) 
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Max.  secret-key  rate  (bps) 
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Secure  PIE  (bit/photon) 
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Current  QKD  records 
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BB84  QKD  (Comandar  et  al.,  2014)  ^  ^ 

High-dimensional  QKD  (HD-QKD)  (Zhong  et  al.,  2015) 
Measurement-device-independent  QKD  (MDI-QKD) 
(Comandar  et  al.,  201 6) 


Continuous  variable  (CV)/GG02  QKD  (Jouguet  et  al.,  2013) 
Six-state  BBM92  QKD  (Treiber  et  al.,  2009) 
Coherent-one-way  (COW)  QKD  (Korzh  et  al.,  2014) 


The  record  highest  secret  key  generation  rate  (HD-QKD,  2016)  is  our  most  recent  experimental  result  (Lee  et  al.,  2016). 
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On-chip  detectors:  Ge  and  SNSPD 
Interferometers:  Contrast  >  80dB  (!) 
Entangled  photon  sources  (sFWM) 
Dense  Wavelength  Division 


phatzcDniczi 


Silicon  photonics  for  QKD 


Switches:  1+GHz 
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QKD  transmitters  in  Silicon  Photonics: 

DWDM:  lOOx  faster 

>100x  cost  reduction 

>103  volume  reduction 

However,  some  modification  needed 


48-channel  transmitter 
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Adapted  from  OpSIS  foundry 


48  Traveling  Wave 

Input  Grating 
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Modulators 

With  Michael  Hochberg  and  Tom  Baehr-Jones  (Coriant) 
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HD-QKD:  PIC-tunable  group  velocity  dispersion 


Resonance  Heater  Contact  Pads 


Input  TCR  Array 
200  pm 


Output 

Coupling  Heater  Contact  Pads  \ 


15  overcoupled  ring  filters  with 
tunable  quality  factor  and 
resonance  frequencies 
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•  Dynamic  dispersion  control  for  maritime  applications 


Block  post-processing  (temporal  green  machine) 

Local  oscillator  Coherent 
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Signals  from  Tx 


Dispersion  chip 
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Adaptive  transmitters  and  receivers 
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Programmable  nanophotonic  processor  (PNP) 


Feedback  control 


Turbulence 
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Programmable  photonic  integrated  circuit 
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Polarization-based  QKD 
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BB84  protocol  with  polarization 
Polarization  is  robust  against  turbulence 
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System  performance  in  local  field  test 
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Fastest  single-channel 
PIC-based  QKD 
at  1 .008  Mbps 
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Summary 


Raytheon  r]p  I  Cl 

BBN  Technologies  msm^ 


Q 

CIPHER  Q 


•  Optimized  secret-key  capacity  through  HD-QKD 

•  Polarization-based  QKD — resistant  to  turbulence 

•  Chip-based  solutions  for  dispersion  and  adaptive  control 


Adaptive  control  using  PICs 

Adaptive  deformable  mirrors 

Size 

Compact 

Large 

Configuration  speed 

~  1  [XS 

~  1  ps 

Phase  stability 

Interferometers  can  be  integrated 

Needs  phase  stable 
interferometers 

Degrees  of  freedom 

Controls  both  phases  &  amplitudes 

Controls  only  phases 
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Outlook 
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•  Demonstration  of  QKD  with  2-4  spectral  channels 

•  Implementation  of  chip-based  adaptive  transmitter 

•  Demonstration  of  green  machine 
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Quantum  networking 
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QKD  over  long  distance 
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Repeaters:  a  special  purpose 
quantum  processor 
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1 

1 
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1 
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-  More  repeater  nodes  is  better  if  the  repeater  nodes  are  perfect 

-  What  if  repeater  nodes  are  constructed  out  of  lossy  /  imperfect 
devices?  What  does  is  take  to  outperform  Rdirect? 


Review  Meeting 
February  17,  2017 


86 


RavtUeon  |-^g  |_g|J  q 
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P  =  1  -  (1  ~Po)M 

Po  (X  771/(-/V+1) 


R  ~  pN+1qN 


Guha,  Krovi,  Fuchs, 
Dutton,  Simon,  Tittel, 
Bond  PRA  (2015) 

Azuma,  Tamaki,  Lo, 
NCOMM  (2015). 

M  Pant  et  al,  PRA  95, 
No.1  (2017) 

M  Pant,  H  Krovi,  D 
Englund,  SG,  PRA  95, 
No.1  (2017)  87 


RavtUeon  |-^g  |_g|J  q 

All-photonic  quantum  repeaters  bbn“^--  —  — 


Quantum  memory 

cold  atoms,  atom-like,  SC  emitters 

cluster  states  Guha,  Krovi,  Fuchs 

Dutton,  Simon,  Tittt 

Photonic  interfaces 

challenging 

0K  PRA  (2015) 

A^ninfi  Tnirml/i  1  n 

>, 

Efficient  ent't  SWAP 

soon 

challenging  ncomm(2015). 

Wavelength 

challenging 

M  Pant  et  al,  PRA  9f 
No.1  (2017) 

Many  qubits 

10s  of  physical  qubits  (5-10  years) 

challenging  M  Pant,  H  Krovi,  D 

Temperature 

cold 

Englund,  SG,  PRA  £ 
OK  No.1  (2017)  ! 

•5, 

58 

Bits  per  mode 
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All  photonic  quantum  repeater:  two-way,  DV 


Q 

CIPHER  Q 


L  (km) 

Azuma,  Tamaki,  Lo,  Nature  Communications  6,  6787  (2015) 
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Resources  required  to  just 
beat  repeaterless  bound 


3M  SPS  per  node  -> 

200K  SPS  per  node  -> 

15  K  GHZ  state  sources 
per  node 
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bits  per  mode 
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All  photonic  quantum  repeater:  one-way,  DV 


_j_\ (n,m)  _  ( \o)®rn±\i)®rn  \®n  Quantum 
±/  ~  v  V2  )  Parity  Code 

Bell  measurement  success  probability  =  1-1/2n 

Ewert,  F.,  Bergmann,  M.,  &  van  Loock,  P.  PRL,  117  (21)  210501,  2016 


(m,n) 

size  of 

state 

tt  of 
single¬ 
photon- 

sources 

#  3-GHZ 

state 

sources 

(8,3) 

48 

200k 

lk 

(9,3) 

Is, 

700k 

3.5k 

(12,4) 

96 

2M 

10k 

(18,5) 

180 

4.4M 

22k 

Device  parameter 

symbol 

value 

fiber  loss  coefficient, 

a 

0.046  km-1 
(0.2  dB/km) 

on-chip  loss  coefficient 

p 

0.62  m-1  (2.7 
dB/m) 

feed-forward  time  in  fiber 

ri 

102.85  ns 

feed- forward  time  on-chip 

20  ps 

chip  to  fiber  coupling  efficiency 

Pc 

0799 

source  detector  efficiency  product 

rjt'Qd 

0.99 

speed  of  light  in  fiber 

cf 

2  x  10s m/s 

speed  of  light  on  chip 

Cch 

7.6  x  10 7m/s 
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M.  Pant,  S.  Muralidharan,  L.  Jiang,  D.  Englund,  and  SG  (in  preparation,  2017) 
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CIPHE-1Q 


Multipath  routing  in  quantum  repeater  network 
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p  =  0.55>pc,  q  =  1 
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p  0.6,  q  0.9  repeater  chains 


Even  with  only  local  information,  2D 
repeater  networks  outperform  linear 
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M.  Pant,  L.  Jiang,  D.  Englund,  D.  Towsley,  P.  Basu,  H.  Krovi  and  SG  (in  preparation,  2017) 
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How  should  repeaters  be  placed? 


Q 
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•  Euclidean  Steiner  Tree  problem:  NP  hard 

-  Minimize  the  total  length  of  pipes  connecting  cities 


Basu  and  Guha,  work  in  progress, 
unpublished  (2017) 

•  Repeater  placement  is  a  more  complication  version 
of  the  Euclidean  Steiner  Tree  problem 

-  Given  user  nodes  (n  potential  Alice-Bob  pairs),  and  proportional  rate 
requirements  for  each  of  the  n  flows,  and  given  optimal  routing 
protocols  at  each  repeater  node  (ideally  assuming  local  link-state 
knowledge),  and  physical  resource  constraints  (e.g.,  sources, 
detectors),  what  number  /  placement  of  repeaters  is  maximizes^te? 


Repeater  for  CV  QKD? 
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•  Amplifiers  (even  phase-sensitive,  quantum  noise 
limited)  do  not  help  as  quantum  repeaters 

Namiki,  Gittsovich,  Guha,  Lutkenhaus,  Phys.  Rev.  A  (201 4) 

•  No  concrete  notion  of  repeater  known  for  CV  QKD 
that  beats  repeater  less  rate  bound 

•  Non-deterministic  linear  amplifiers:  suggested  by 
Tim  Ralph  -  NOT  clear  if  it  can  beat  Rdirect 

•  Alternative  repeater  techniques  for  CV.  Developing 
CV  /  hybrid  error  correction  techniques 
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CONQUEST  program 
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Task  1 :  QKD  operation  and 
security  analysis  for  a  naval 
atmospheric  link  with  a 
realistic  eavesdropper 

Task  2:  Maritime- 
implementable  QKD 
protocols 

Task  3:  Maximizing  the 
information  efficiency  of  QKD 

Task  4:  Improved  hardware- 
domain  signal  processing 

Task  5:  QKD  network  via  un¬ 
trusted  quantum  nodes 

Task  6:  Important  technical 
issues  to  address  current 
deficiencies  in  the 
theory/practice  of  QKD 


Saikat  /  Kathryn  -  team  introduction,  task 
descriptions  and  technical  plan:  10  minutes 


Jeff  -  Security  analysis  with  realistic 
eavesdropping  assumptions:  15  minutes 


Jeff  /  Franco  -  Flood  light  QKD:  theory  and 
experiments:  15  minutes 


Kamil  -  security  proof  for  discrete  modulation 
CV  QKD:  15  minutes 


Saikat  -  efficient  post-processing  for  CV  QKD: 

15  minutes 


Mark  -  Finite  key-length  analysis  for  QKD:  15 

minutes 


Darius  /  Dirk  -  PIC  based  transmitters  and 
receivers  for  QKD:  15  minutes 


Saikat  -  Free-space  quantum  networking  / 
wrap  up  - 15  minutes 
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